UAE PDPL Compliance Guide
What the UAE's Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) asks of businesses, what still waits on its executive regulations, and how the DIFC and ADGM regimes sit beside it.
Jan 2022
Effective Date
Not set in the law
Fines · left to a Cabinet decision
All Sectors
Applies To
The short answer
What does the UAE PDPL require of a website?
Under the UAE PDPL (Federal Decree-Law No. 45 of 2021), a website needs a legal basis before analytics and advertising tags process visitor data, which in practice means asking for consent first and recording it. It also needs a way to answer data requests, a plan to notify the UAE Data Office of a breach, and security measures.
Overview
The UAE Personal Data Protection Law (PDPL) is Federal Decree-Law No. 45 of 2021 Concerning the Protection of Personal Data, issued on 20 September 2021 and in force since 2 January 2022.
It is the UAE's first comprehensive federal data protection law. It covers organisations in the UAE that process personal data, and organisations outside the UAE that process personal data of people inside it.
Entities in free zones with their own data protection law, such as the DIFC and ADGM, are governed by those laws instead, and some categories covered by other legislation are excluded. The UAE Data Office is the supervisory authority.
Personal data is any data relating to an identified or identifiable natural person, including online identifiers. Processing needs the data subject's consent unless one of the exceptions the law lists applies, such as performing a contract or meeting a legal obligation, and consent must be specific, clear and unambiguous and can be withdrawn at any time.
Data subjects can obtain information about their data and a copy of it, and ask for it to be corrected, erased, restricted, moved or no longer processed, including by automated means. Controllers must keep a record of processing, protect data with appropriate measures, and report breaches to the Data Office.
Much of the detail is left to executive regulations, which had not been published on the UAE's official legislation portal as of September 2026. The law sets no fine amounts: Article 26 leaves the violations and the administrative penalties to a Cabinet decision, and none had been published on the portal as of September 2026.
Key Requirements
- 01
A Basis for Processing
Get the data subject's consent, or rely on one of the exceptions the law lists, such as performing a contract or meeting a legal obligation.
- 02
Consent Standards
Obtain clear, specific, informed, and unambiguous consent. Consent must be freely given and withdrawable at any time.
- 03
Data Subject Rights
Provide access, rectification, erasure, portability, restriction of processing, and right to object to automated decisions.
- 04
Breach Notification
Notify the UAE Data Office and affected data subjects of personal data breaches without undue delay.
- 05
Records of Processing
Maintain detailed records of all data processing activities, including purposes, categories of data, and retention periods.
- 06
Security Measures
Implement appropriate technical and organizational measures to protect personal data against unauthorized access and breaches.
Cookies
What does the UAE PDPL mean for a website's cookies?
The federal law has no provision written for cookies. When a cookie or tracker can identify a visitor, what it collects is personal data, and processing personal data needs consent unless one of the law's exceptions applies. For analytics and advertising tags, asking for consent before they run is the practical way to have that basis.
That means the same banner a Saudi website needs: clear categories, a real way to refuse, settings that stay reachable so consent can be withdrawn, and a record of each choice. Until the executive regulations are published, the law's own consent conditions are the standard to build to.
What a cookie banner in the UAE has to do, step by stepHow the Saudi PDPL handles cookiesThree frameworks
Federal law, DIFC and ADGM: which one applies to you?
Most businesses in the UAE fall under the federal law. Entities established in the Dubai International Financial Centre (DIFC) or the Abu Dhabi Global Market (ADGM) fall under those free zones' own data protection laws, which have their own regulators.
- Federal Decree-Law No. 45 of 2021
- Mainland UAE and free zones without their own data protection law. Supervised by the UAE Data Office. Fines and much of the detail wait on Cabinet decisions and executive regulations.
- DIFC Data Protection Law No. 5 of 2020
- Entities established in the DIFC. Closely modelled on the GDPR, with its own Commissioner of Data Protection. Read our guide
- ADGM Data Protection Regulations 2021
- Entities established in the ADGM, with ADGM's Office of Data Protection as regulator. Read our guide
A business selling into the UAE from abroad should start from the federal law, which also reaches organisations outside the UAE that process personal data of people inside it.
Selling into Saudi Arabia too? PDPL for international companiesPenalties for Non-Compliance
The decree-law does not set fine amounts. Article 26 leaves the violations and the administrative penalties to a Cabinet decision, which had not been published on the UAE's official legislation portal as of September 2026.
- 01
Fines Set by Cabinet Decision
No amount appears in the decree-law. A fine figure quoted for the federal law, such as AED 10 million, has no basis in its text; treat it with caution until the Cabinet decision is issued.
- 02
Free-Zone Regimes
The DIFC and ADGM enforce their own data protection laws, with their own regulators and penalties, on entities established there.
- 03
Complaints to the Data Office
Data subjects can complain to the UAE Data Office if they believe their personal data is being processed in breach of the law.
How Arqam360 Helps
- 01
Consent Collection
The Arqam360 banner asks for consent by purpose, lets visitors withdraw it at any time, and records each choice with its date and time.
- 02
DSAR Handling
Automated data subject request processing with multi-platform data retrieval and compliant response generation.
- 03
Compliance Audit Trail
Every consent action, data processing activity, and policy change logged with timestamps for regulatory audits.
- 04
Arabic Support
Native Arabic and English consent banner with RTL layout. Serve both Arabic-speaking and English-speaking visitors in the UAE.
Enforcement Timeline
Decree-Law Issued
Federal Decree-Law No. 45 of 2021 was issued on 20 September 2021 and published in the Official Gazette on 26 September 2021.
Law in Force
The law came into force on 2 January 2022 (Article 31).
Executive Regulations
Article 28 called for executive regulations within six months of the law's issue. As of September 2026 they had not been published on the UAE's official legislation portal.
Compliance Deadline
Controllers and processors have six months from the executive regulations' issue to bring their processing into line (Article 29), and the Cabinet may extend that once for the same period. That clock has not started.
Check Your Site Against the UAE PDPL
Run a free scan to see which cookies and trackers your site sets before and after consent.
Scan Your SiteDone for you
We set it up on your website
We install the consent banner, wire Google Consent Mode v2, test your Google and Meta tags, and publish your bilingual privacy policy. $299 to install, then $99.99 a month per domain.
Regulations
Compliance guides for GDPR, PDPL, and more
UAE PDPL FAQ
Common questions about the UAE Personal Data Protection Law.
The UAE's federal data protection law has no cookie-specific rule, but a cookie that can identify a visitor collects personal data, and processing it needs consent unless an exception applies. In practice, a UAE website should ask before analytics and advertising tags run, offer a real way to refuse, let visitors withdraw consent, and record each choice.
Questions, answered
Ask Before You Track in the UAE
Put an Arabic and English consent banner on your site, keep a dated record of every choice, and pass it to Google Consent Mode v2. We can install it and test your Google and Meta tags for you.